From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD98DC43381 for ; Thu, 7 Mar 2019 14:53:11 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AC9E72081B for ; Thu, 7 Mar 2019 14:53:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="NxWKEJal" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AC9E72081B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender:Content-Type: Content-Transfer-Encoding:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date:Message-ID:From: References:To:Subject:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=O6uQrS9xsFW2IgkR4whcKz231g+QyxRLkYkhk/dozBE=; b=NxWKEJal9Gj21Jyoe91GD92D0 MIzPmCSLbELbeQiuV78p/GCqAkYvwZIOHJy5nye8Vmj6ZGG5WyFdW0spth7SiFSVE1Hidq18p73Pe RYCUdsUdoC1u5W8gUKuEXqIIwfJj8s30dADZ6VkkQe1AJ+L2NxZY74mCf8m/i8ed7bZDBvB84POz1 AAAu0T+ranSgJ87ySvB0723hh3xaAMTAQ6g7qR1zhSZ+Fnj/juej6jgk4iMtXiwrLqzQKiXXoBLAw lTy6fGK6pI5joHSM4b/fYLo0oyI3DSicVxQPTmBP3x0I7Rq7we61IoSDvlIz+scMafPeSWjOXFWTz LZuIrTSyQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h1uOO-0008BV-3i; Thu, 07 Mar 2019 14:53:04 +0000 Received: from foss.arm.com ([217.140.101.70]) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h1uOK-0007zj-Ps for linux-arm-kernel@lists.infradead.org; Thu, 07 Mar 2019 14:53:02 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id E6D45EBD; Thu, 7 Mar 2019 06:52:58 -0800 (PST) Received: from [10.1.196.75] (e110467-lin.cambridge.arm.com [10.1.196.75]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id F03D13F71D; Thu, 7 Mar 2019 06:52:56 -0800 (PST) Subject: Re: [PATCH/RFC] driver core: Postpone DMA tear-down until after devres release To: John Garry , Geert Uytterhoeven References: <20190207193653.18221-1-geert+renesas@glider.be> <20190208164019.GY32526@8bytes.org> <6e64e564-aa6c-4193-1f57-ebf88d6932d5@arm.com> <1b24a2dc-e9a3-f293-8dd1-360896a554e6@huawei.com> From: Robin Murphy Message-ID: Date: Thu, 7 Mar 2019 14:52:55 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <1b24a2dc-e9a3-f293-8dd1-360896a554e6@huawei.com> Content-Language: en-GB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190307_065300_856249_9AFD325B X-CRM114-Status: GOOD ( 22.92 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Geert Uytterhoeven , "Rafael J . Wysocki" , Greg Kroah-Hartman , Joerg Roedel , Linux Kernel Mailing List , Linux-Renesas , Linux IOMMU , Christoph Hellwig , Linux ARM , Marek Szyprowski Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="windows-1252"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi John, On 07/03/2019 14:45, John Garry wrote: [...] > Hi guys, > = > Any idea what happened to this fix? It's been in -next for a while (commit 376991db4b64) - I assume it will = land shortly and hit stable thereafter, at which point somebody gets to = sort out the manual backport past 4.20. Robin. > I have this on 5.0: > = > [=A0=A0=A0 0.000000] Linux version 5.0.0 (john@htsatcamb-server) (gcc ver= sion = > 4.8.5 (Linaro GCC 4.8-2015.06)) #121 SMP PREEMPT Thu Mar 7 14:28:39 GMT = > 2019 > [=A0=A0=A0 0.000000] Kernel command line: BOOT_IMAGE=3D/john/Image rdinit= =3D/init = > crashkernel=3D256M@32M earlycon console=3DttyAMA0,115200 acpi=3Dforce = > pcie_aspm=3Doff scsi_mod.use_blk_mq=3Dy no_console_suspend pcie-hisi.disa= ble=3D1 > = > ... > = > [=A0=A0 26.806856] pci_bus 000c:20: 2-byte config write to 000c:20:00.0 = > offset 0x44 may corrupt adjacent RW1C bits > [=A0=A0 26.817521] pcieport 0002:f8:00.0: can't derive routing for PCI IN= T B > [=A0=A0 26.837167] pci_bus 000c:20: 2-byte config write to 000c:20:00.0 = > offset 0x44 may corrupt adjacent RW1C bits > [=A0=A0 26.850091] serial 0002:f9:00.1: PCI INT B: no GSI > [=A0=A0 26.879364] serial 0002:f9:00.1: enabling device (0000 -> 0003) > [=A0=A0 26.913131] 0002:f9:00.1: ttyS3 at I/O 0x1008 (irq =3D 0, base_bau= d =3D = > 115200) is a ST16650V2 > [=A0=A0 26.992897] rtc-efi rtc-efi: setting system clock to = > 2019-03-07T14:41:48 UTC (1551969708) > [=A0=A0 27.009380] ALSA device list: > [=A0=A0 27.015326]=A0=A0 No soundcards found. > [=A0=A0 27.022549] Freeing unused kernel memory: 1216K > [=A0=A0 27.055567] Run /init as init process > root@(none)$ cd /sys/devices/platform/HISI0162:01 > root@(none)$ echo HISI0162:01 > driver/unbind > [=A0=A0 36.488040] hisi_sas_v2_hw HISI0162:01: dev[9:1] is gone > [=A0=A0 36.561077] hisi_sas_v2_hw HISI0162:01: dev[8:1] is gone > [=A0=A0 36.621061] hisi_sas_v2_hw HISI0162:01: dev[7:1] is gone > [=A0=A0 36.693074] hisi_sas_v2_hw HISI0162:01: dev[6:1] is gone > [=A0=A0 36.753066] hisi_sas_v2_hw HISI0162:01: dev[5:1] is gone > [=A0=A0 36.764276] sd 0:0:3:0: [sdd] Synchronizing SCSI cache > [=A0=A0 36.821106] hisi_sas_v2_hw HISI0162:01: dev[4:1] is gone > [=A0=A0 36.889048] hisi_sas_v2_hw HISI0162:01: dev[3:1] is gone > [=A0=A0 36.993002] hisi_sas_v2_hw HISI0162:01: dev[1:1] is gone > [=A0=A0 37.004276] sd 0:0:0:0: [sda] Synchronizing SCSI cache > [=A0=A0 37.014768] sd 0:0:0:0: [sda] Stopping disk > [=A0=A0 37.709094] hisi_sas_v2_hw HISI0162:01: dev[2:5] is gone > [=A0=A0 37.721231] hisi_sas_v2_hw HISI0162:01: dev[0:2] is gone > [=A0=A0 37.803774] BUG: Bad page state in process sh=A0 pfn:11356 > [=A0=A0 37.814444] page:ffff7e000044d580 count:1 mapcount:0 = > mapping:0000000000000000 index:0x0 > [=A0=A0 37.830525] flags: 0xfffc00000001000(reserved) > [=A0=A0 37.839443] raw: 0fffc00000001000 ffff7e000044d588 ffff7e000044d58= 8 = > 0000000000000000 > [=A0=A0 37.854998] raw: 0000000000000000 0000000000000000 00000001fffffff= f = > 0000000000000000 > [=A0=A0 37.870552] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) = set > [=A0=A0 37.883485] bad because of flags: 0x1000(reserved) > [=A0=A0 37.893098] Modules linked in: > [=A0=A0 37.899221] CPU: 5 PID: 2691 Comm: sh Not tainted 5.0.0 #121 > [=A0=A0 37.910578] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilico= n = > D05 IT21 Nemo 2.0 RC0 04/18/2018 > [=A0=A0 37.928924] Call trace: > [=A0=A0 37.933825]=A0 dump_backtrace+0x0/0x150 > [=A0=A0 37.941166]=A0 show_stack+0x14/0x1c > [=A0=A0 37.947808]=A0 dump_stack+0x8c/0xb0 > [=A0=A0 37.954451]=A0 bad_page+0xe4/0x144 > [=A0=A0 37.960918]=A0 free_pages_check_bad+0x7c/0x84 > [=A0=A0 37.969307]=A0 __free_pages_ok+0x284/0x290 > [=A0=A0 37.977173]=A0 __free_pages+0x30/0x44 > [=A0=A0 37.984163]=A0 __dma_direct_free_pages+0x68/0x6c > [=A0=A0 37.993076]=A0 dma_direct_free+0x24/0x38 > [=A0=A0 38.000591]=A0 dma_free_attrs+0x84/0xc0 > [=A0=A0 38.007930]=A0 dmam_release+0x20/0x28 > [=A0=A0 38.014924]=A0 release_nodes+0x128/0x1f8 > [=A0=A0 38.022439]=A0 devres_release_all+0x34/0x4c > [=A0=A0 38.030478]=A0 device_release_driver_internal+0x190/0x208 > [=A0=A0 38.040963]=A0 device_release_driver+0x14/0x1c > [=A0=A0 38.049526]=A0 unbind_store+0xbc/0xf4 > [=A0=A0 38.056517]=A0 drv_attr_store+0x20/0x30 > [=A0=A0 38.063859]=A0 sysfs_kf_write+0x44/0x4c > [=A0=A0 38.071200]=A0 kernfs_fop_write+0xd0/0x1c4 > [=A0=A0 38.079065]=A0 __vfs_write+0x2c/0x158 > [=A0=A0 38.086055]=A0 vfs_write+0xa8/0x19c > [=A0=A0 38.092696]=A0 ksys_write+0x44/0xa0 > [=A0=A0 38.099338]=A0 __arm64_sys_write+0x1c/0x24 > [=A0=A0 38.107203]=A0 el0_svc_common+0xb0/0x100 > [=A0=A0 38.114718]=A0 el0_svc_handler+0x70/0x88 > [=A0=A0 38.122232]=A0 el0_svc+0x8/0x7c0 > [=A0=A0 38.128356] Disabling lock debugging due to kernel taint > [=A0=A0 38.139019] BUG: Bad page state in process sh=A0 pfn:11355 > [=A0=A0 38.149682] page:ffff7e000044d540 count:0 mapcount:0 = > mapping:0000000000000000 index:0x0 > [=A0=A0 38.165760] flags: 0xfffc00000001000(reserved) > [=A0=A0 38.174676] raw: 0fffc00000001000 ffff7e000044d548 ffff7e000044d54= 8 = > 0000000000000000 > [=A0=A0 38.190230] raw: 0000000000000000 0000000000000000 00000000fffffff= f = > 0000000000000000 > [=A0=A0 38.205783] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) = set > [=A0=A0 38.218716] bad because of flags: 0x1000(reserved) > [=A0=A0 38.228329] Modules linked in: > [=A0=A0 38.234451] CPU: 5 PID: 2691 Comm: sh Tainted: G=A0=A0=A0 B 5.0.0 = #121 > [=A0=A0 38.248604] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilico= n = > D05 IT21 Nemo 2.0 RC0 04/18/2018 > [=A0=A0 38.266949] Call trace: > [=A0=A0 38.271844]=A0 dump_backtrace+0x0/0x150 > [=A0=A0 38.279185]=A0 show_stack+0x14/0x1c > [=A0=A0 38.285826]=A0 dump_stack+0x8c/0xb0 > [=A0=A0 38.292468]=A0 bad_page+0xe4/0x144 > [=A0=A0 38.298936]=A0 free_pages_check_bad+0x7c/0x84 > = > ... > = > Thanks, > John > = >> Thanks, >> Robin. >> >>>> There aren't many drivers using dmam_alloc_*(), let alone which would >>>> also find themselves behind an IOMMU on an Arm system, but it turns out >>>> I actually have another one which can reproduce the BUG() with 5.0-rc. >>> >>> SATA core uses dmam_alloc_*(). >>> >>>> I've tried a 4.12 kernel with a bit of instrumentation[1] and sure >>>> enough the devres-managed buffer is freed with the wrong ops[2] even >>>> then. How it manages not to blow up more catastrophically I have no >>>> idea... I guess at best it just leaks the buffers and IOMMU mappings, >>>> and at worst quietly frees random other pages instead. >>> >>> May depend on the actual ops, and whether CMA is used or not. >>> >>> Gr{oetje,eeting}s, >>> >>> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Geert >>> >> >> _______________________________________________ >> linux-arm-kernel mailing list >> linux-arm-kernel@lists.infradead.org >> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel >> >> . >> > = > = _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel